GHSA-FXJ4-P9XP-37V5 HAPI FHIR: Incomplete fix for CVE-2026-45367: DSTU2 FHIRPathEngine.matches() missing RegexTimeout protection allows ReDoS

Summary The fix for CVE-2026-45367 added RegexTimeout protection to the matches function in DSTU2016MAY, DSTU3, R4, R4B, and R5, but the DSTU2 module was incompletely patched. In org.hl7.fhir.dstu2, replaceMatches was updated while matches at line 2462 still calls the raw String.matchessw without...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=5.0.0, <=5.0.2), ca.uhn.hapi.fhir:hapi-fhir-cli-jpaserver (>=5.0.0, <=5.0.2) +38 more potentially affected by CVE-2026-55470 via ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.0.0)

ca.uhn.hapi.fhir:org.hl7.fhir.convertors MAVEN version 5.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.convertors and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-cli-api =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0,...

ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.0.7) potentially affected by CVE-2026-55470 via ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.0.7)

ca.uhn.hapi.fhir:org.hl7.fhir.convertors MAVEN version 5.0.7 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.convertors and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.validation 5.0.7 Source cves: CVE-2026-55470 Sour...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.4.2), ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.4.2) potentially affected by CVE-2026-55470 via ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 (5.4.2)

ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 MAVEN version 5.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.4.2 - ca.uhn.hapi.fhir:org.hl7.fhir.validation...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.4.3), ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.4.3) potentially affected by CVE-2026-55470 via ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 (5.4.3)

ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 MAVEN version 5.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.4.3 - ca.uhn.hapi.fhir:org.hl7.fhir.validation...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.5.3), ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.5.3) potentially affected by CVE-2026-55470 via ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 (5.5.3)

ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 MAVEN version 5.5.3 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.5.3 - ca.uhn.hapi.fhir:org.hl7.fhir.validation...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.5.9), ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.5.9) potentially affected by CVE-2026-55470 via ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 (5.5.9)

ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 MAVEN version 5.5.9 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.5.9 - ca.uhn.hapi.fhir:org.hl7.fhir.validation...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.5.10), ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.5.10) potentially affected by CVE-2026-55470 via ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 (5.5.10)

ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 MAVEN version 5.5.10 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.5.10 - ca.uhn.hapi.fhir:org.hl7.fhir.validati...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (1.0.0), ca.uhn.hapi.fhir:org.hl7.fhir.report (1.0.0) +1 more potentially affected by CVE-2026-55470 via ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 (1.0.0)

ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 MAVEN version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 1.0.0 - ca.uhn.hapi.fhir:org.hl7.fhir.report 1.0...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (4.0.1), ca.uhn.hapi.fhir:org.hl7.fhir.validation (4.0.1) +1 more potentially affected by CVE-2026-55470 via ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 (4.0.1)

ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 MAVEN version 4.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 4.0.1 - ca.uhn.hapi.fhir:org.hl7.fhir.validation...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.3.1), ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.3.1) potentially affected by CVE-2026-55470 via ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 (5.3.1)

ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 MAVEN version 5.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.3.1 - ca.uhn.hapi.fhir:org.hl7.fhir.validation...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.6.2), ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.6.2) potentially affected by CVE-2026-55470 via ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 (5.6.2)

ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 MAVEN version 5.6.2 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.6.2 - ca.uhn.hapi.fhir:org.hl7.fhir.validation...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.6.45), ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.6.45) potentially affected by CVE-2026-55470 via ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 (5.6.45)

ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 MAVEN version 5.6.45 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.6.45 - ca.uhn.hapi.fhir:org.hl7.fhir.validati...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.6.46), ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.6.46) potentially affected by CVE-2026-55470 via ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 (5.6.46)

ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 MAVEN version 5.6.46 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.6.46 - ca.uhn.hapi.fhir:org.hl7.fhir.validati...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.6.48), ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.6.48) potentially affected by CVE-2026-55470 via ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 (5.6.48)

ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 MAVEN version 5.6.48 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.6.48 - ca.uhn.hapi.fhir:org.hl7.fhir.validati...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.6.51), ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.6.51) potentially affected by CVE-2026-55470 via ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 (5.6.51)

ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 MAVEN version 5.6.51 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.6.51 - ca.uhn.hapi.fhir:org.hl7.fhir.validati...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (6.4.1), ca.uhn.hapi.fhir:hapi-fhir-cli-app (6.4.1) +21 more potentially affected by CVE-2026-55470 via ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.6.97)

ca.uhn.hapi.fhir:org.hl7.fhir.validation MAVEN version 5.6.97 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.validation and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-cli-api 6.4.1 - ca.uhn.hapi.fhir:hapi-fhir-cli-app...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.0.12), ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.0.12) +3 more potentially affected by CVE-2026-55470 via ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 (5.0.12)

ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 MAVEN version 5.0.12 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.0.12 - ca.uhn.hapi.fhir:org.hl7.fhir.validati...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.6.100), ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.6.100) potentially affected by CVE-2026-55470 via ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 (5.6.100)

ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 MAVEN version 5.6.100 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.6.100 -...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.6.9), ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.6.9) potentially affected by CVE-2026-55470 via ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 (5.6.9)

ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 MAVEN version 5.6.9 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.6.9 - ca.uhn.hapi.fhir:org.hl7.fhir.validation...